Azure Files Entra ID Kerberos groups showing as Unknown SID in NTFS

Dudi Fire 0 Reputation points
2026-04-26T10:22:36.3433333+00:00

Hello there,

I'm trying to set up an azure files at my clients workspace but I'm getting troubles with set up permissions by groups, If I give some endpoint access to data he able to reach it but if mi trying to give a group of peoples access it is not working by some unknown reason

I'm adding picture of the groups I've set

Thanks for the help, much appreciated

Dudi

User's image

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-04-26T10:23:05.2366667+00:00

    Azure Files access with Microsoft Entra ID requires both:

    1. Share-level permissions (Azure RBAC on the storage account / file share), and
    2. NTFS (Windows ACL) permissions on the directories/files.

    If users can access the share when permissions are granted directly to their identity but not when granted via a group, the issue is typically in how group membership is evaluated from the Kerberos ticket and mapped to Entra groups.

    Key points and checks:

    1. Ensure the group is present in the Kerberos ticket
      For AD DS–backed scenarios, Azure Files reads group SIDs from the Kerberos ticket and authorizes based on those SIDs, not on what appears in the Entra admin center. Users who are not synced individually can still access if their on-premises AD DS group is synced and has the required RBAC role. If the group SID is missing from the ticket, Azure Files cannot match it and the group will effectively behave like an unknown SID.
    2. Verify group sync and RBAC
      • The on-premises AD DS group must be synced to Microsoft Entra ID.
      • That synced group must have the appropriate Azure RBAC role on the storage account or file share (for example, Storage File Data SMB Share Contributor or other relevant role).
      • Non-synced users can still access through that synced group, but authorization is based solely on the group SIDs in the Kerberos ticket.
    3. Understand “Unknown SID” behavior in tools
      Some management tools (like File Explorer or certain ACL viewers) may show SIDs instead of friendly names when they cannot resolve them. For Azure Files, the important part is that the SID in the ACL matches a group SID in the Kerberos ticket; the display name is cosmetic. If the SID is truly unknown (no matching group in Entra/AD), the ACL entry will never grant access.
    4. Check for group-SID limits with Entra Kerberos (cloud-only identities)
      If using Microsoft Entra Kerberos with cloud-only identities, Kerberos tickets have a hard limit of 1,010 group SIDs. Large group memberships (including nested/dynamic groups) can cause ticket issuance to fail or omit groups, which then appear ineffective in NTFS permissions. In Entra sign-in logs this appears as error 140011 – KerberosUsersGroupNumberExceeded. In that case:
      • Reduce group memberships for affected users, especially nested/dynamic groups.
      • Ensure the storage account’s Entra application manifest is configured with the "kdc_enable_cloud_group_sids" tag when using cloud-only identities so cloud group SIDs are handled correctly.
    5. Confirm Microsoft Entra Kerberos configuration
      • After enabling Entra Kerberos for Azure Files, grant admin consent to the autogenerated service principal for the storage account (the app named [Storage Account] <storage-account-name>.file.core.windows.net).
      • Do not modify that service principal beyond the documented steps; misconfiguration can cause ticket or group resolution issues.
    6. Troubleshoot with Kerberos and sign-in logs
      • Use klist on the client to verify a Kerberos ticket for cifs/<storage-account-name>.file.core.windows.net is issued and check for errors.
      • Review Entra sign-in logs for the storage account app for errors like KerberosUsersGroupNumberExceeded or AADSTS50105 (assignment required), which can block ticket issuance and group-based access.

    In summary, for group-based access to work and not show as unknown/ineffective:

    • Ensure the group is synced and assigned the correct Azure Files RBAC role.
    • Ensure the group SID is present in the Kerberos ticket (no group-SID limit issues).
    • Verify Entra Kerberos and the storage account’s service principal are configured as documented.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.